Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream

SigmaHQ Detections@sigmaHQ

•updated Sep 2, 2024•0•23

Detects the creation of hidden files or folders by appending the "::$index_allocation" stream to their names. This technique can be used by adversaries to prevent standard tools like Windows Explorer or PowerShell from accessing or listing these hidden artifacts, thereby evading detection and hindering forensic analysis.